Restrict Access To USB Devices

[MuppetQueen]

I hope I have posted this in the correct section...

 

How do you restrict access to USB devices for students. Our students seem to come into school with 1000s of £££ of electronic equipment and they are pretty smart too!?!

 

Do you have any software that you use? We are a Microsoft school (I know) with Server 2K3 and Windows XP.

[Ric_]

When you say devices, do you mean USB drives or full blown deices such as scanners, printers, etc?

 

(Beat this though, I had one kid bring his PSP to have a file copied onto it! That's one expensive way of transferring files!!!)

[adamyoung]

We'd also like to block USB pen drives (again we're a Microsoft Win 2003/XP network)

[Geoff]

Already answered this twice, lol.

 

http://www.edugeek.net/index.php?name=Forums&file=viewtopic&p=5517#5517

http://www.edugeek.net/index.php?name=Forums&file=viewtopic&p=6144#6144

 

Second link blocks CD/DVD/Floppy too if you like.

[Ric_]

@adamyoung: I've somehow managed to do this by mistake and I'm having hell's own job getting them to work - it's something in the Citrix policies though I feel.

[mac_shinobi]

Probably been answered already but for the heck of it disable it in the bios and then geoff or someone in the previous thread suggested a template I believe :0

[MuppetQueen]

Sorry, I didn't see the other threads - lol. Think I will be a Newbie for a while longer.

 

I did know how to restrict through GPO but this is by machine only. Staff use USB drives to take work home etc. I would just like to restrict on a per user basis.

 

Does anyone pay for any application that is not too expensive but does this job? I feel I may have to restrict to only the admin computers or those in the staff workroom. I don't trust any of the PCs/teachers in the classroom?!?

[Geoff]

I think designating paticular machines is the way to go. If only because you can turn up the antivirus to paranoid on those machines.

[MuppetQueen]

Thanks again Geoff. I think you are probably right. It's just sometimes difficult to get staff to see the dangers.

 

Will speak to SMT and implement.

 

Cheers

[mac_shinobi]

Just out of curiousty :

 

If you had an application that would enable / disable USB would that allow you to do it on a per user basis ?

[mac_shinobi]

what about this :

 

http://techrepublic.com.com/5208-6247-0.html?forumID=12&threadID=116436&messageID=1678065

[mac_shinobi]

Here is something else as well with regards to what microsoft have to say about it :

 

http://www.hannesschmidt.de/node/29

[MkII]

Y'know I had the opposite problem - no one could access USB devices. The reason was that for the first available device I'd mapped a network share, so the USB device was effectively hidden.

 

So...

 

For staff leave a drive letter available before the 1st mapped drive letter, and the students [or however you want to set it in GPO], don't leave a gap.

 

The only problem with this bodge is that if you have differring numbers of devices in machines - but then you could get around that by assigning drive letters at the end of the alphabet.

 

[carries on conversation with self! lol!]

[ChrisH]

Virtually alll my work stations just have a HD and no other drives. I just restrict C: for staff and C: and all others for students.

[Roger]

Geoff,

I get an error message when I try to add this template:-

 

The following error occured in

\\lancasterhigh.lancs.sch.uk\sysvol\lancasterhigh.lancs.sch.uk\Policies ....

adm on line 19:

Error 51 Unexpected keyword

 

Found: CATEGOR

Expected: CATEGORY

 

The file cannot be loaded.

 

I have double checked the text entry, CATEGORY is spelt correctly !!

 

Have you used this template successfully?

 

Ta, Roger

[Geoff]

Is that a 2000 server?

[Roger]

Geoff,

Tis 2003 Server, there is obviously a difference hence your question !!

Go on then educate me !!

 

Ta, Roger

[SmartArt]

Restricting access to usb pens has pros and cons. I can understand the necessary paranoia about having a device that's capable of holding a complete O/S and goodness knows what else as boot & root kit.

 

I would think having a machine or three per room that were open to all could be very beneficial, particualry with the annoying habit of even simple files growing to amazing sizes, that would have been considered grossly inflated even two or thee years ago. Kids with the new DIDa family of qualifications are going to need USB pens/portable hdds to be able to take their coursework to and from home. It's inescapable. I would rather have am ironclad sheepdip where kids had to have their devices scanned before before being allowed onto a pukka networked PC. Would there not be a way to link an encrypted token, valid for that period/day, onto a freshly scanned device. It wouldn't have top be a very big file, only big enough to hold something like Blowfish/MD5 key?

 

I don't know about Windows but with a Linux box you could do this and restrict path of files taken from the USB device to a holding area if there was any doubt.

 

Any other thoughts or ideas or tweaks to this idea?

Because, remember, at the end of the day, those of us who work in schools, teahers, admin, support, whoever we are have to constantly ask ourselves this question: is what we are doing/going to do benefit the kids' educations. And being to allow kids to port large files vis a US pen to my mind will. And it's a lot betterthan having the "cherubs" being to send stuff (big stuff, little stuff, contraband stuff via email.

 

I sit back and awit the scorch marks to appear on my screen. :-)

[MkII]

Welcome SmartArt BTW . Good to have your input.

 

The requirements of DIDa are pushing us all to the limits I think. There are nice solutions to cater for the ePortfolio - but they're all very expensive, as in 'the opposite' of what most schools will be able to implement for some time.

 

Surely there's also substantial educational benefit in the discipline of keeping file sizes small, and the efficient management of online work? In the past we've turned a blind eye to the bloated files created by MS Office, which isn't clever.

 

Our whole authority impose a 2mb limit on email attachments, so that's never going to be an alternative to large file movement here.

 

As is being said tight restriction on USB attached storage is possible, and something I do along with many others. I suppose the question is: what importance do you place on the security of data on your system. I think it folly that schools are at liberty to decide thier own policies on this. The law doesn't descriminate of course but then that's apprioaching the problem from the wrong end imho.

[Ric_]

@SmartArt: It isn't practical to allow access on some machines and not others - we strive to make everything the same to give the pupils a common platform for teaching and learning... I'm sure as a teacher you prefer to be able to tell the kids how to do something on one machine and have them able to on all.

 

The other issues associated with USB pens would also not be addressed - data protection and the introductuction of viruses to name just two.

 

Surely the ability to send a a multi-megabyte email will be sufficient for most users.

[tarquel]

Our whole authority impose a 2mb limit on email attachments...

 

On their end - or at our end?

 

i.e. on your NGFL box? or on the email box that we all send to?

 

The head will be moaning like hell if its the same for all of us - 2MB is a little stingy - publisher files anyone?

 

Nath

[MkII]

Thier end [on the incoming mail box] - and it's been that way for the last 10 years I think! Where've you bin??

[tarquel]

The head has been sending some large files to home etc and back so I'm she hasnt mentioned that anythings wrong [apart from the recent nominet thing hehe] so I can only think that that cant be the case anymore mark.

 

A 5th former send an attachment of her work home to work on....er...at home the other day - last week i think. She hasnt mentioned anything either so maybe ts your NGFL system :P

 

Nath.

[MkII]

You dare challenge SquirrelMail!!! :D

[tarquel]

Hell yes :P